CVE-2026-44034 OFFIS CVE debrief

Who should care

Defenders of systems handling DICOM files with RLE compression, particularly those using DCMTK 3.7.0, should assess exposure and apply the fix. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of DICOM files and related systems.

Why it matters

CVE-2026-44034 is a medium-severity vulnerability in DCMTK 3.7.0 that can lead to data leakage or application crashes. Defenders of systems handling DICOM files with RLE compression should assess exposure and apply the fix.

• Potential data leakage of up to 63 bytes of adjacent heap memory
• Possible crash of affected applications
• Requires verification of affected version and exposure
• Remediation priority for systems handling DICOM files with RLE compression

Technical summary

A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RLE header. The function copies 64 bytes without checking the fragment length, a check that the sibling function decode() already performs. This vulnerability can lead to data leakage or application crashes and has a medium severity level. Defenders should assess exposure and apply the fix.

Defensive priority

Medium priority for systems handling DICOM files with RLE compression

Recommended defensive actions

• Assess exposure of systems handling DICOM files with RLE compression
• Verify if affected version 3.7.0 is in use
• Apply fix from commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the heap-based out-of-bounds read vulnerability in DCMTK 3.7.0. The issue is confirmed to be fixed in commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d. Evidence limits are based on source-provided information and may not be exhaustive. Further verification is recommended to ensure accurate exposure assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.